Regulation S-K Item 106
Regulation S-K Item 106 requires SEC registrants to disclose their cybersecurity risk management, strategy, and governance in annual filings, including how the board oversees cyber risk and how management assesses and manages material cyber risks.
What Item 106 Requires
Item 106 has two main components. First, registrants must describe their processes for assessing, identifying, and managing material cybersecurity risks, including how those processes are integrated into overall risk management. Second, they must describe management's role in assessing and managing risks and the board's oversight of cyber risk.
The disclosure appears in annual reports (Form 10-K) rather than as event-triggered filings. It gives investors a periodic view of how cyber risk is being governed, complementing the incident-specific disclosures required under Item 1.05.
Why Item 106 Matters
Item 106 elevates cyber governance from an internal matter to a disclosed one. Registrants now describe publicly how their board is engaged in cyber oversight, what expertise the board has, how frequently cyber is discussed, and how management reports on cyber risk. This has meaningfully changed board dynamics at SEC registrants.
See how CISOs communicate cyber risk to boards.
Item 106 in Practice
Disclosures under Item 106 have accumulated since the rule took effect. Common themes include increased description of quantified cyber risk practices, more formal cyber committee structures at the board level, and clearer articulation of management-to-board reporting cadence. Quantified programs typically have more substantive disclosures than qualitative-only programs.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
